CVE-2019-11709
published 2019-07-23CVE-2019-11709: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory…
PriorityP340critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.35%
81.6th percentile
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | firefox | < firefox 68.0-1 (sid) | firefox 68.0-1 (sid) |
| debian | firefox-esr | < firefox 68.0-1 (sid) | firefox 68.0-1 (sid) |
| debian | thunderbird | < firefox 68.0-1 (sid) | firefox 68.0-1 (sid) |
| mozilla | firefox | < 60.8.0 | 60.8.0 |
| mozilla | firefox | < 68.0 | 68.0 |
| mozilla | firefox | >= 0 < 68.0+build3-0ubuntu0.16.04.1 | 68.0+build3-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 68.0.1+build1-0ubuntu0.16.04.1 | 68.0.1+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 68.0+build3-0ubuntu0.18.04.1 | 68.0+build3-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 68.0.1+build1-0ubuntu0.18.04.1 | 68.0.1+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= unspecified < 68 | 68 |
| mozilla | firefox_esr | >= unspecified < 60.8 | 60.8 |
| mozilla | thunderbird | < 60.8.0 | 60.8.0 |
| mozilla | thunderbird | >= 0 < 1:60.8.0-1 | 1:60.8.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.8.0-1 | 1:60.8.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.8.0-1 | 1:60.8.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.8.0-1 | 1:60.8.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.8.0+build1-0ubuntu0.16.04.2 | 1:60.8.0+build1-0ubuntu0.16.04.2 |
| mozilla | thunderbird | >= 0 < 1:60.8.0+build1-0ubuntu0.18.04.1 | 1:60.8.0+build1-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= unspecified < 60.8 | 60.8 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xhg3-p7wr-4hrx: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60
ghsa_unreviewed·2022-05-24
CVE-2019-11709 [CRITICAL] CWE-119 GHSA-xhg3-p7wr-4hrx: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
OSV
firefox regressions
osv·2019-07-25·CVSS 9.8
CVE-2019-9811 [CRITICAL] firefox regressions
firefox regressions
USN-4054-1 fixed vulnerabilities in Firefox. The update introduced
various minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
A sandbox escape was discovered in Firefox. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass same origin restrictions, conduct cross-site scripting
(XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof
origin attributes, spoof the addressbar
OSV
CVE-2019-11709: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60
osv·2019-07-23·CVSS 9.8
CVE-2019-11709 [CRITICAL] CVE-2019-11709: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
OSV
thunderbird vulnerabilities
osv·2019-07-17·CVSS 9.8
CVE-2019-9811 [CRITICAL] thunderbird vulnerabilities
thunderbird vulnerabilities
A sandbox escape was discovered in Thunderbird. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same origin restrictions, conduct cross-site scripting (XSS)
attacks, spoof origin attributes, or execute arbitrary code.
(CVE-2019-11709, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713,
CVE-2019-11715, CVE-2019-11717)
It was discovered that NSS incorrectly handled importing certain
curve25519 private keys. An attacker could exploit this issue to c
OSV
firefox vulnerabilities
osv·2019-07-12·CVSS 9.8
CVE-2019-9811 [CRITICAL] firefox vulnerabilities
firefox vulnerabilities
A sandbox escape was discovered in Firefox. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass same origin restrictions, conduct cross-site scripting
(XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof
origin attributes, spoof the addressbar contents, bypass safebrowsing
protections, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11710,
CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714,
CVE-2019-11715, CVE-2
Ubuntu
Firefox regressions
vendor_ubuntu·2019-07-25·CVSS 9.8
CVE-2019-9811 [CRITICAL] Firefox regressions
Title: Firefox regressions
Summary: USN-4054-1 caused some minor regressions in Firefox.
USN-4054-1 fixed vulnerabilities in Firefox. The update introduced
various minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
A sandbox escape was discovered in Firefox. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass same origin restrictions, conduct cross-site scripting
(XSS) attacks, conduct cross-site request
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2019-07-17·CVSS 9.8
CVE-2019-9811 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
A sandbox escape was discovered in Thunderbird. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same origin restrictions, conduct cross-site scripting (XSS)
attacks, spoof origin attributes, or execute arbitrary code.
(CVE-2019-11709, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713,
CVE-2019-11715, CVE-2019-11717)
It was discovered that NSS incorrectly handled importing certai
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2019-07-12·CVSS 9.8
CVE-2019-9811 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
A sandbox escape was discovered in Firefox. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass same origin restrictions, conduct cross-site scripting
(XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof
origin attributes, spoof the addressbar contents, bypass safebrowsing
protections, or execute arbitrary code. (CVE-2
Red Hat
Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
vendor_redhat·2019-07-10·CVSS 9.8
CVE-2019-11709 [CRITICAL] CWE-120 Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Package: firefox (Red Hat Enterprise Linux 5) - Out of support scope
Debian
CVE-2019-11709: firefox - Mozilla developers and community members reported memory safety bugs present in ...
vendor_debian·2019·CVSS 9.8
CVE-2019-11709 [CRITICAL] CVE-2019-11709: firefox - Mozilla developers and community members reported memory safety bugs present in ...
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Scope: local
sid: resolved (fixed in 68.0-1)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1547266%2C1540759%2C1548822%2C1550498%2C1515052%2C1539219%2C1547757%2C1550498%2C1533522https://lists.debian.org/debian-lts-announce/2019/08/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2019/08/msg00002.htmlhttps://security.gentoo.org/glsa/201908-12https://security.gentoo.org/glsa/201908-20https://www.mozilla.org/security/advisories/mfsa2019-21/https://www.mozilla.org/security/advisories/mfsa2019-22/https://www.mozilla.org/security/advisories/mfsa2019-23/http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1547266%2C1540759%2C1548822%2C1550498%2C1515052%2C1539219%2C1547757%2C1550498%2C1533522https://lists.debian.org/debian-lts-announce/2019/08/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2019/08/msg00002.htmlhttps://security.gentoo.org/glsa/201908-12https://security.gentoo.org/glsa/201908-20https://www.mozilla.org/security/advisories/mfsa2019-21/https://www.mozilla.org/security/advisories/mfsa2019-22/https://www.mozilla.org/security/advisories/mfsa2019-23/
2019-07-23
Published